CVE-2020-7062 HIGH

CVE-2020-7062: Null Pointer Dereference in PHP Session Upload Progress

Vendor Php Group
Product PHP
Weakness CWE-476
Published February 27, 2020
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.upload_progress.cleanup is set to 0 (disabled), and the file upload fails, the upload procedure would try to clean up data that does not exist and encounter null pointer dereference, which would likely lead to a crash.

Key dates

02Disclosure timeline

February 27, 2020 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-20875 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability CVE-2025-15156 omec-project UPF PFCP Session Establishment Request messages_session.go handleSessionEstablishmentRequest null pointer dereference CVE-2022-36013 Null-dereference in `mlir::tfg::GraphDefImporter::ConvertNodeDef` in TensorFlow CVE-2025-44013 QTS, QuTS hero CVE-2026-47337 NULL pointer dereference in Ubuntu Linux AppArmor IPv4/IPv6 socket mediation